Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
18-05-2024 03:12
General
-
Target
ca8c670d287814ca4a56b220c360a7c3caa0ef396a9b29f391f21c9b29d49862.dll
-
Size
2.0MB
-
MD5
c310c7db42c40895be867d7bc96f7047
-
SHA1
f17440cf1fd4ddce619ac0a0ce78ec05efc3b658
-
SHA256
ca8c670d287814ca4a56b220c360a7c3caa0ef396a9b29f391f21c9b29d49862
-
SHA512
268f4d01d481d5f941ecb64ef5103c0a21c3ea977abd834360dd04437d8b2d2d5287ebd2cc1f2f662d138dfeda74ea930a99a29fcb04b18f0af9351d7c201901
-
SSDEEP
12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8c670d287814ca4a56b220c360a7c3caa0ef396a9b29f391f21c9b29d49862.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\cTEifEO\LicensingUI.exeC:\Users\Admin\AppData\Local\cTEifEO\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\eTj6nX\SndVol.exeC:\Users\Admin\AppData\Local\eTj6nX\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\B9vNYOy\msdt.exeC:\Users\Admin\AppData\Local\B9vNYOy\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD55faa922d99fd6787a2d781c7d82d6c77
SHA117701e538e66f984a40b00445d75d4f7fe192524
SHA256d1173c7ea459a6af6bc7c68467bff4c39d0399a643d59252b12c4d667993ef58
SHA51276de5b5ff10a6514ab24bfe351f50df3645dd3bfadc61a27982b2e5c6f20be6927f5e2afad17de3d00b42dbaaba4a9995316857dbddd01d824872a1bdf8aaefc
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
2.3MB
MD5f153daf04c7ce473909d2ab1c14f51e7
SHA16084d1974d3086e4de9c70cc86362733a8862f4f
SHA25616e6f9e428801055225d5b72011dec0e36f2567f3ebc430100bf92cb584244cb
SHA512273c5664f9ba62fc9aa7f19e4067a2689f2debdb6ba54c871eafd63465c995e57e1343fcd0e567411d6b10a45788ff9f459a2ba863828b99cbaca94614ff69af
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
2.0MB
MD50c84d971bc85ffd296a00e15ae7dac87
SHA1047208f10ad52e68bda95aa112b066e6284d4dcb
SHA256d079dbe4eabbb972e0efc1d2c8490a3a61c9d70fd713b975a0ecfc0aff63b43b
SHA512de76228a1ac86cfbf1a5eed5a2c48d0e8babb4b8ccc98e65f2b091c1ec2ae727d547ba4a56e2cd9ab11b0aee1f6887aa722424d6f871314cd524cde07d345132
-
Filesize
1KB
MD5a72fe8783c562eb3772f03074af6ba67
SHA153874ed135a4ca479d10dffd410a1e38cec7d1bc
SHA256df9a64bcd1b16393cfb7760171c916d9000c0703de0deb764e9acb0d6d4abb14
SHA512b2a7c041459c1149918e8fb9bfe1f6d5d11a7044678601b07b97b5a520ec471906f86f0f4aa9e9cf4354840921cf91d555af6ec81fc8c22faaa3d3ae37a63a34
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.3MB